CompTIA SecurityX

Decisions about risk need numbers that stand up to challenge. You set appetite, compare qualitative and quantitative methods, model loss with structured approaches, and treat third-party and aggregate risk.

• Risk appetite, tolerance and capacity
• Qualitative and quantitative assessment
• Loss modeling with FAIR and expected loss
• Business impact analysis
• Third-party and supply chain risk
• Risk acceptance, transfer and reporting

You build A quantified risk analysis of one scenario, with ranges, assumptions and a treatment recommendation.

Modeling threats before building prevents rework. You apply structured methods to systems and data flows, map adversary behavior to frameworks, and feed the results into design and detection.

• STRIDE, PASTA and attack trees
• Data flow diagrams and trust boundaries
• MITRE ATT&CK for planning and gap analysis
• Kill chain and diamond model reasoning
• Threat modeling cloud and microservice systems
• Turning models into requirements and tests

You build A threat model of a multi-tier cloud application, with prioritized mitigations.

Obligations differ by industry and country, and they conflict. You map regulations and frameworks to controls, prepare for audit with evidence, and handle legal holds, privacy duties and cross-border data.

• Industry and privacy regulation in outline
• Control frameworks and mapping between them
• Audit preparation and evidence management
• Legal holds and e-discovery
• Cross-border transfers and data residency
• Handling conflicts between obligations

You build A control mapping across two frameworks and a regulation, with evidence sources for each control.

Architecture sets the cost of every later decision. You apply layered defense, secure-by-design and resilience principles, use reference models, and weigh competing requirements on a real design.

• Defense in depth and fail-safe design
• Reference architectures and enterprise frameworks
• Secure by design and by default
• Resilience, redundancy and recovery design
• Data flows and trust zones
• Documenting architecture decisions and trade-offs

You build An architecture decision record set for a new line-of-business platform.

Cloud changes where controls live. You design identity, network and data controls across providers, secure containers and serverless workloads, and monitor posture so drift is caught.

• Shared responsibility across service models
• Workload identity and secrets
• Posture management and cloud access brokers
• Securing containers, orchestration and serverless
• Multi-cloud and hybrid control consistency
• Landing zones and guardrails

You build A cloud security reference design with guardrails, identity model and monitoring plan.

Trust inside the network can no longer be assumed. You design segmentation and microsegmentation, apply zero trust principles to access, and secure remote and partner connectivity.

• Zero trust architecture components
• Segmentation and microsegmentation
• Software-defined perimeter and secure access service edge
• Next-generation firewalls and proxies
• DNS and email security architecture
• Partner, remote and third-party connectivity

You build A zero trust migration plan with segmentation design for an existing flat network.

Identity and data are what attackers want. You design identity systems with federation and privileged access control, and layer classification, loss prevention and encryption around the data itself.

• Federation with SAML, OAuth and OpenID Connect
• Privileged access and just-in-time access
• Passwordless authentication and FIDO
• Data classification and loss prevention
• Encryption architecture and key hierarchies
• Secrets management at scale

You build An identity and data protection architecture for a company with partners and contractors.

Cryptography fails through design and operation more than mathematics. You design public key infrastructure, choose protocols and modes, manage keys through their life and plan for quantum-resistant change.

• PKI design: hierarchies, trust and revocation
• TLS configuration and forward secrecy
• Authenticated encryption and modes of operation
• Hardware roots of trust and key protection
• Homomorphic encryption and secure computation uses
• Post-quantum migration planning
• Cryptographic failures seen in real systems

You build A PKI and key management design with a cryptographic agility and migration plan.

Large estates need a program, not a scan. You set up enterprise vulnerability management, direct testing by red and purple teams, and assure software and its supply chain with analysis and bills of materials.

• Enterprise vulnerability management programs
• Prioritizing at scale with business context
• Red, blue and purple team exercises
• Static, dynamic and interactive application testing
• Fuzzing and software composition analysis
• Software bills of materials and supply chain assurance

You build A vulnerability management program design with prioritization model and assurance plan.

Controls that depend on people drift. You express security as code, build it into pipelines, automate response and configuration, and evaluate AI-assisted tools for the risks they add.

• Infrastructure and policy as code
• Securing continuous integration and delivery
• Hardening baselines and drift detection
• Orchestration and automated response
• Scripting and APIs for security teams
• Evaluating AI-assisted security tooling

You build A pipeline that enforces policy as code and blocks a non-compliant deployment.

Detection is engineered, tested and maintained like any other system. You design log pipelines and SIEM content, build and test detections, and use behavioral analytics without drowning the team in alerts.

• Log pipeline and SIEM architecture
• Detection as code and test-driven detection
• Behavioral analytics and anomaly detection
• Measuring detection coverage
• Alert quality and tuning at scale
• Cloud and identity monitoring

You build A detection suite mapped to adversary techniques, with coverage gaps identified.

Senior staff direct how the organization finds and handles intrusions. You lead hunts, manage the external attack surface, run an incident from first alert to closure and set the lessons that follow.

• Hypothesis-driven threat hunting
• External attack surface management
• Incident command and decision making
• Forensics and evidence at scale
• Crisis communication and legal coordination
• Post-incident review and program changes

You build An incident command plan and tabletop exercise for a serious breach.

One scenario spans the whole domain. You assess an enterprise, set its governance and risk direction, design its architecture and engineering, plan its operations and present the case to its leadership.

• Assessing the current state
• Setting governance and risk priorities
• Designing architecture and engineering changes
• Planning operations and response
• Presenting the strategy to executives

You build A security strategy and roadmap, with architecture, risk case and operating model.